Legal notice, privacy and cookies: what your website must comply with in Spain

Any website that promotes a business in Spain has to follow a few rules, even a simple one-page site. It isn't complicated, but it is worth doing right from the start: fines exist and, above all, a compliant site builds trust.

This article is general guidance, not legal advice.

1. The legal notice

Spain's information society services law (LSSI) requires the site owner to be identified. The legal notice must include at least:

• The owner's name or company name.
• Their tax ID (NIF or CIF).
• Their address.
• A contact email.
• For companies, their Companies Register details.
• Where the activity requires it, the professional association or the relevant licence.

It is usually linked from the footer of every page.

2. The privacy policy

If your site collects personal data (a contact form already does), the GDPR requires you to explain clearly:

• Who is responsible for the data and how to contact them.
• What it is used for and on what legal basis.
• How long it is kept.
• Whether anyone else accesses it (the hosting provider, for example).
• The person's rights, and that they can complain to the Spanish Data Protection Agency (AEPD).

Next to the form there must be a link to that policy and a box to accept it. And an important point: collect only the data you need. If you won't phone anyone, don't make the phone number mandatory.

3. Cookies

This is where the famous banner comes in. The rule is simple: if your site sets cookies that aren't strictly necessary for it to work (third-party analytics, advertising, embedded videos or maps from other platforms), you need the visitor's prior consent, with a banner that makes accepting and rejecting equally easy.

The cleanest option for a small business is not to use third-party cookies at all:

• Link to Google Maps instead of embedding the map.
• Link to your videos instead of embedding them.
• If you want statistics, use a cookieless tool.

That saves you the banner and the site loads faster. It is still good practice to have a cookie policy page explaining that none are used.

4. Other things to keep in mind

• Prices: if you publish them, say whether VAT is included.
• Online sales: if you sell through the site, terms of sale, the right of withdrawal and shipping information are added.
• Accessibility: increasingly required; readable text, good contrast and described photos help everyone.

How we do it

Every site we build at Codeqlick includes a legal notice, privacy policy and cookie policy adapted to your business, a contact form with its privacy checkbox and no third-party cookies, so no banner is needed. We review it with you before going live.

Questions about your current site? Get in touch and we'll take a look.